Update vendored skills

Vendored skills are never edited; they are replaced from upstream at a commit and checked against skills-lock.json in CI. Each upstream's pin lives in UPSTREAMS in src/design_agent/skills_lock.py, with the skills it vendors into skills/ (runtime) and .agents/skills/ (coding agents). uv run design-agent skills sync-vendor --check-only compares every pin with its upstream's newest release (HyperFrames) or main commit (LangChain's packs).

HyperFrames